| Cryptographic architecture with instruction masking and other techniques for thwarting differential power analysis -> Monitor Keywords |
|
|
 Cryptographic architecture with instruction masking and other techniques for thwarting differential power analysisRelated Patent Categories: Information Security, Protection Of HardwareThe Patent Description & Claims data below is from USPTO Patent Application 20070180541. Brief Patent Description - Full Patent Description - Patent Application Claims
CROSS REFERENCE TO RELATED APPLICATIONS [0001] This application is a continuation-in-part of U.S. patent application Ser. Nos. 10/864,569; 10/864,556 and 10/864,568 all filed on Jun. 8, 2004 and respectively entitled "Cryptographic Architecture with Random Instruction Masking to Thwart Differential Power Analysis", "Cryptographic Bus Architecture for the Prevention of Differential Power Analysis" and "Cryptographic CPU Architecture with Random Instruction Masking to Thwart Differential Power Analysis." The disclosure of each of these related applications is hereby incorporated by reference. BACKGROUND OF THE INVENTION [0002] 1. Field of the Invention [0003] The present invention relates to the security of cryptographic methods and the cryptographic architecture of a processor used in microelectronic assemblies, such as Smart Cards and the like, in order to prevent security breaches of the same when a Differential Power Analysis (DPA) attack is utilized. [0004] 2. Description of Related Art [0005] Cryptographic techniques are well-known in the art. Indeed, they date from at least the time of Caesar when the need to keep certain information secret from prying eyes became important enough for people to find ways to disguise the information by means of codes and ciphers. [0006] Today, cryptographic techniques are in a wide array of applications, both governmental and private. One application of cryptographic techniques is to protect information stored in a Smart Card and/or to protect the capabilities of the Smart Card from unauthorized use or modifications. Cryptographic devices, such as Smart Cards, use secret keys to process input information and/or to produce output information. It has been assumed that the information stored in a cryptographic device, such as a Smart Card, is relatively safe from attack provided that an especially strong cryptographic technique is utilized. [0007] Modern cryptography utilizes transposition and substitution of digital data. Messages to be encrypted, known as plaintext, are transformed by a function that is parameterized by a key. The output of the encryption process, known as the ciphertext, is then transmitted. The received ciphertext is then decrypted, using a key, back into plaintext. [0008] One example where modern cryptography is used is in pay-TV conditional-access systems such as pay channels for cable and satellite television. Smart cards and/or security processors (containing secret keys) are used to decrypt the television signals. Attackers buy a cable or satellite receiver and then attack the smart card or security processor inside in order to determine the secret keys. The cipher text is the information sent from the cable or satellite provider, and the plaintext is the decrypted television signal sent to the television. Thus, it is generally assumed that the input and output information, i.e. the plaintext and ciphertext, is available to attackers, and information about the secret keys is unavailable. FIG. 1 depicts a cryptographic system. An attacker may attack the smart card or security processor by looking for information related to the secret keys that may be leaked via EM radiation, power consumption, timing etc. The leaked information, commonly referred to as side channel information, can then be used by attackers in order to determine the secret key used. One common technique for determining a secret key from leaked or side channel information is known as Differential Power Analysis (DPA). Unfortunately, there is no way to guarantee that power consumption, EM radiation, etc. will not leak certain cryptographic process information being performed by a device and thus obtain information about the secret [0009] Therefore, defensive techniques are needed that produce leaked information that is unusable by hackers using correlation techniques such as DPA. [0010] The following background discussion is provided in order to supply a context for one application of the presently disclosed technology, which involves a well-known cipher, the data encryption standard (DES), for which DPA analysis is commonly used to break. One skilled in the art will appreciate that this discussion is for illustration purposes only, and that the present invention may be utilized to protect secret keys of a number of data encryption formats from a number of hacking techniques in which side channel information is used in order to determine the secret keys. [0011] The well-known DES cipher utilizes a number, typically 16, of substitution box (S-Box) functions. The S-Box functions are non-linear and can be implemented by using table lookups, Boolean logic or appropriately programmed computers. [0012] It has been discovered within the past several years that DPA can be utilized by attackers to determine the secret keys used in cryptographic devices employing DES such as Smart Cards, where in particular the digital encryption standard (DES) is used. See, for example, Differential Power Analysis published by Paul Coker, et al., Cryptographic Research of San Francisco, Calif. A tutorial on DPA is also provided in the article, Power Analysis Tutorial, published by Manfred Aigner, et al., of the Institute for Applied Information Processing and Communication, University of Technology, Graz, Austria. As described in these references, in order to utilize the DPA technique, the attacker monitors the power consumption of the cryptographic device. The fluctuations in the power used by the device reflect the operations going on within the device and that, in turn, can be used to glean information about the secret keys stored within the device. [0013] It is emphasized, however, that side channel information other than power consumption information may be studied by DPA to extract encryption keys. Some ples are electro-magnetic (EM) radiation and faulty outputs. Unfortunately, there is no way to guarantee that power consumption, EM radiation, and the like, will not leak certain information, and it is believed that it is impractical to expect cryptographic devices, such as Smart Cards, to be completely leak-free in terms of information being able to be discerned by their power consumption, EM radiation or the like. However, defensive techniques can be used that make whatever information is leaked uncorrelatable, even if sophisticated statistical approaches are used, for example, in the DPA process. As such, the present invention is concerned with a solution to the problem of making power consumption information uncorrelatable to the secret keys stored within a cryptographic device, such as a Smart Card. [0014] In the prior art, certain decorrelation techniques do exist. See, for example, U.S Pat. Nos. 6,295,606 and 6,298,153 to Messerges, et al., and published European Patent Application Number 1,098,469 of Boeckeler. [0015] The decorrelation techniques discussed in published European Patent Application Number 1,098,469 by Gregor Boeckeler, superimpose a random current profile based on a secondary clock CLK2, inserted upon the existing profile of a CPU which is based on a master clock CLK1. Each clock is randomly adjusted in a range between 3-7 MHz. Due to two clocks differing from one another with respect to their center frequencies, the combined current profile is randomized which makes a DPA attacker's job more difficult. [0016] Thomas Messerges, in U.S. Pat. No. 6,208,135, uses a randomized starting point in the set of target bits. Mr. Messerges processes the corresponding target bits in a different order; thus it becomes difficult for a DPA attacker to group related target bits from all the plaintexts of interest in order to perform statistical analyses associated with given target bit positions. However, not only does this approach not conceal the information leaked by a data bus; it also cannot prevent a malicious attacker from using this information to reorder the target bit into the correct bit position. [0017] Mr. Messerges also developed another technique, as discussed in U.S. Pat. No. 6,295,606, that uses a random mask to keep the message and key hidden both while they are stored in memory, and during processing by the cryptographic algorithm itself However, since the mask is randomly changed, new S-boxes must be updated accordingly, and this takes time. The disadvantage is that this kind of masking operation slows down the DES algorithm by a factor of three to five. In addition, this kind of masking operation cannot prevent an attacker from gathering a 48-bit partial key from Round Sixteen when the results must be eventually unmasked to provide the correct output of the cipher. Thus Messerges' approach becomes vulnerable to DPA after unmasking. With 48 bits now known at Round Sixteen, the remaining six key bits to make 56 can then be exhaustively searched by an attacker. The present approach is computationally faster, and it also can prevent an attacker from gathering the partial key from Round Sixteen of the DES algorithm. [0018] These prior art approaches have certain limitations and therefore need improvement. This invention proposes a unique Random Instruction Mask (RIM) as a countermeasure to the DPA process, effectively making power consumption un-correlatable to cipher bit values. The present invention has the following advantages over the techniques of Messerges, Boeckler and others: [0019] (1) More Efficient Calculations: The techniques taught by Messerges et al. slow down the DES algorithm by 300 to 500% due to the regular update of the S-boxes. In the present invention, the DES algorithm will be slowed down by approximately 15%. [0020] (2) More Robust: Even in the presence of leaked information for multiple address locations. [0021] (3) Better Protection: 48-bits of a key can be completely concealed in the last DES round, (in DES the output is unmasked at the end of the algorithm thereby exposing the key, which is not solved by the prior art), and [0022] (4) Low Power Consumption: There is an increase in power consumption by less than 1% compared to Boeckeler's random current profiling, which increases power consumption to about 200% during cryptographic operations. [0023] Before discussing the details of the preferred embodiments disclosed herein, additional details related to the DES algorithm and DPA attacks will be provided. If the reader is new to this area, further information may be found in the following articles: P. Kocher, J. Jaffe, and B. Jun, "Introduction to Differential Power Analysis and Related Attacks," 1998; Thomas S. Messergers, Ezzy A. Dabbish, and Robert H. Sloan, "Investigations of Power Analysis Attacks on Smartcards", in Proceedings of USENIX Workshop on Smartcard Technology, Chicago, Ill., May 1999, pp. 151-161; and Manfred Aigner and Elisabeth Oswald, "Power Analysis Tutorial" Institute for Applied Information Processing and Communication University of Technology Graz, Austria. The following discussion is offered to provide a context for a detailed explanation of the presently disclosed technology. [0024] The DES algorithm is an example of an iterative-block cipher. DES is described in detail in ANSI X.392, "American National Standard for Data Encryption Algorithm (DEA)," American Standards institute, 1981, which is incorporated by reference herein. The DES cipher is well known and utilizes a number, typically sixteen, of substitution-permutation box (SP-Box) functions instituted in program sequences called rounds. The SP box functions are non-linear and are conventionally implemented using lookup tables or Boolean logic gates or appropriately programmed computers. In each of the sixteen rounds, the DES encryption algorithm performs eight SP box operations, in turn, by accessing sequentially each lookup table (or by using equivalent logic gates). The eight SP boxes each take, as input, a scrambled 6-bit key, (here, scrambled means that the key has been XOR-ed and shifted) and produce a 4-bit output target to be accessed by the CPU for OR-ing operations. Each such 6-bit scrambled key is an SP box's entry address. Table 1 shows the C-language representation of SP boxes 1 and 2 in a 32-bit implementation of DES. DES can run with 16, 32, and 64 bits but we have chosen the 32-bit representation as a nominal example. From Table 1 note that each SP lookup contains 64 elements. Each element in a nominal DES implementation is 32-bits and embeds a given 4-bit output target. This embedding will now be described in greater detail. [0025] The data bus is typically 32-bits wide, this 4-bit output target is distributed somewhere within a 32-bit word according to the permutation rules (one per SP box) as implied in Table 1, where the data is presented in a hexadecimal format. That is, each SP lookup table will have a different embedding position for a given 4-bit output target. For example, lookup table SP1, shown in Table 1, embeds a 4-bit output target at bit positions 24, 16, 10 and 2 in a 32-bit word. Lookup table SP2 embeds a 4-bit output target at bit positions 20, 5, 31 and 15, where bit 20 is the most significant bit (MSB) and bit 15 is the least significant bit (LSB) for a given 4-bit output. As a further illustration, the first four entries of lookup table SP1, i.e., SP1 [0:3]={0x01010400L, 0x00000000L, 0x00010000L, 0x01010404L} have 4-bit output target values of 14, 0, 4, 15. Specifically, SP1 [0] {0x01010400L} is embedded with a 4-bit output target value of 14 (i.e, 1110). For example, for SP1 [0] the 32 bit binary word is 0000 0001 0000 0001 0000 0100 0000 0000. The right most digit is the LSB while the left most digit is the MSB for a given 32-bit binary word. To derive the 4-bit output target, the values of the bits at 24, 16, 10, and 2 are used. For example, for SP1 [0] the 4-bit output target is 1110. This is determined by looking for the MSB value of the 4-bit output target at position 24, the next bit is at position 16, the third bit is at position 10, and finally the LSB of 0 is at position 2 of the 32 bit binary word SP1 [0]. The bit positions, 24, 16, 10 and 0 are underlined in the binary representation given above. The fourth entry SP1 [3]={0x01010404L}, (which differs from the 1110 of SP1 [0] only at the LSB), has a 4-bit output target value of 15 (i.e., 1111). [0026] On the other hand, the lookup table SP2 illustrates different embedding bit position scheme as shown in the first four entries of lookup table SP2, i.e., SP2[0:3]={0x80108020L, 0x80008000L, 0x000080000L, 0x00108020L.} Only the contents at bit positions 20, 5, 31 and 15 are changed to reflect the values of 15, 3, 1, 13 for the corresponding 4-bit blocks. In particular, the first entry of lookup table SP2, SP2[0]={0x80108020L] has a 4-bit output target value of 15 (i.e., 1111) because bit 20, 5, 31 and 15 all have a value of 1. The fourth entry SP2[3]={0x00108020L}, (which differs with 1111 of SP2[0] only at the 2nd LSB), has a 4-bit target value of 13 (i.e., 1101). Continue reading... Full patent description for Cryptographic architecture with instruction masking and other techniques for thwarting differential power analysis Brief Patent Description - Full Patent Description - Patent Application Claims Click on the above for other options relating to this Cryptographic architecture with instruction masking and other techniques for thwarting differential power analysis patent application. ###  How KEYWORD MONITOR works... a FREE service from FreshPatents1. Sign up (takes 30 seconds). 2. Fill in the keywords to be monitored. 3. Each week you receive an email with patent applications related to your keywords. Start now! - Receive info on patent apps like Cryptographic architecture with instruction masking and other techniques for thwarting differential power analysis or other areas of interest. ### Previous Patent Application: Method and apparatus for limiting the ability of a user device to replay content Next Patent Application: Memory system with in stream data encryption / decryption Industry Class: ### FreshPatents.com Support Thank you for viewing the Cryptographic architecture with instruction masking and other techniques for thwarting differential power analysis patent info. IP-related news and info Results in 0.3008 seconds Other interesting Feshpatents.com categories: Accenture , Agouron Pharmaceuticals , Amgen , AT&T , Bausch & Lomb , Callaway Golf |
||
